Linz Public Transport
PassAudited by ClawScan on May 1, 2026.
Overview
The skill appears purpose-aligned for Linz public transport lookups, with the main things to notice being local Python execution and outbound requests to a configurable transit API URL.
This skill looks benign for public transit lookups. Before installing, make sure you are comfortable with it running the included Python script and sending stop/departure queries to the configured Linz EFA API base URL.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may run the included Python script when answering Linz transit questions.
The skill instructs the agent to run an included local Python helper. This is expected and proportionate for the stated transport-query purpose.
Use `{baseDir}/scripts/linz_transport.py` as the default execution path.Install if you are comfortable with a local Python helper being run for Linz transport lookups.
Stop searches and departure requests are sent to the configured endpoint; with the default HTTP URL, requests or responses may be observable or alterable on the network.
The skill makes outbound API requests and permits the endpoint base URL to be overridden. This is disclosed and purpose-aligned, but users should know where queries are being sent.
Base URL input: `--base-url <url>` argument, or `LINZ_TRANSPORT_API_BASE_URL` environment variable, or default `http://www.linzag.at/linz2`.
Use the official Linz endpoint and prefer an HTTPS base URL if supported; avoid setting the base URL to untrusted hosts.